list_del corruption, ffff888050dfa090->next is NULL ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:53! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 10004 Comm: syz.3.1454 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 RIP: 0010:__list_del_entry_valid_or_report+0xdf/0x190 lib/list_debug.c:52 Code: 49 39 1f 0f 85 9e 00 00 00 b0 01 5b 41 5c 41 5d 41 5e 41 5f e9 52 5c f8 06 cc 48 c7 c7 a0 e8 27 8c 48 89 de e8 12 51 6e fc 90 <0f> 0b 48 c7 c7 00 e9 27 8c 48 89 de e8 00 51 6e fc 90 0f 0b 4c 89 RSP: 0018:ffffc90000007d58 EFLAGS: 00010046 RAX: 0000000000000033 RBX: ffff888050dfa090 RCX: 8dc35dc03e074800 RDX: 0000000000000100 RSI: 0000000080000102 RDI: 0000000000000000 RBP: 0000000000000203 R08: ffffc90000007ae7 R09: 1ffff92000000f5c R10: dffffc0000000000 R11: fffff52000000f5d R12: 1ffff1100a1bf412 R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888125457000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055e5656e7000 CR3: 0000000077ef2000 CR4: 00000000003526f0 Call Trace: __list_del_entry_valid include/linux/list.h:132 [inline] __list_del_entry include/linux/list.h:223 [inline] list_del_init include/linux/list.h:295 [inline] dst_destroy+0x202/0x5a0 net/core/dst.c:163 rcu_do_batch kernel/rcu/tree.c:2617 [inline] rcu_core+0x7cd/0x1070 kernel/rcu/tree.c:2869 handle_softirqs+0x22a/0x870 kernel/softirq.c:626 __do_softirq kernel/softirq.c:660 [inline] invoke_softirq kernel/softirq.c:496 [inline] __irq_exit_rcu+0x5f/0x150 kernel/softirq.c:727 irq_exit_rcu+0x9/0x30 kernel/softirq.c:743 instr_sysvec_apic_timer_interrupt arch/x86/kernel/apic/apic.c:1056 [inline] sysvec_apic_timer_interrupt+0xa6/0xc0 arch/x86/kernel/apic/apic.c:1056 asm_sysvec_apic_timer_interrupt+0x1a/0x20 arch/x86/include/asm/idtentry.h:697 RIP: 0010:lock_acquire+0x20b/0x2e0 kernel/locking/lockdep.c:5872 Code: e9 30 ff ff ff e8 85 50 0d 0a f7 c3 00 02 00 00 0f 84 38 ff ff ff 65 48 8b 05 01 fe 7a 11 48 3b 44 24 30 75 33 fb 48 83 c4 38 <5b> 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc 48 8d 3d 8e aa 73 RSP: 0018:ffffc9000c177310 EFLAGS: 00000292 RAX: 8dc35dc03e074800 RBX: 0000000000000246 RCX: 0000000080000001 RDX: 00000000747a73c7 RSI: ffffffff8e16d13e RDI: ffffffff8c27e560 RBP: 0000000000000000 R08: ffffffff823c1e54 R09: ffffffff8e760620 R10: dffffc0000000000 R11: fffff940003f7761 R12: 0000000000000002 R13: ffffffff8e760620 R14: 0000000000000000 R15: 0000000000000000 rcu_lock_acquire include/linux/rcupdate.h:312 [inline] rcu_read_lock include/linux/rcupdate.h:850 [inline] page_table_check_clear+0x164/0x5f0 mm/page_table_check.c:77 ptep_get_and_clear_full arch/x86/include/asm/jump_label.h:-1 [inline] clear_full_ptes include/linux/pgtable.h:906 [inline] zap_present_folio_ptes mm/memory.c:1643 [inline] zap_present_ptes mm/memory.c:1712 [inline] do_zap_pte_range mm/memory.c:1814 [inline] zap_pte_range mm/memory.c:1916 [inline] zap_pmd_range mm/memory.c:2002 [inline] zap_pud_range mm/memory.c:2030 [inline] zap_p4d_range mm/memory.c:2051 [inline] unmap_page_range+0x33ba/0x48b0 mm/memory.c:2072 unmap_single_vma mm/memory.c:2114 [inline] unmap_vmas+0x48f/0x6a0 mm/memory.c:2152 exit_mmap+0x280/0xa10 mm/mmap.c:1302 __mmput+0x118/0x430 kernel/fork.c:1175 exit_mm+0x168/0x220 kernel/exit.c:581 do_exit+0x6a2/0x23c0 kernel/exit.c:962 do_group_exit+0x21b/0x2d0 kernel/exit.c:1116 get_signal+0x1284/0x1330 kernel/signal.c:3032 arch_do_signal_or_restart+0xbc/0x830 arch/x86/kernel/signal.c:337 __exit_to_user_mode_loop kernel/entry/common.c:64 [inline] exit_to_user_mode_loop+0x86/0x480 kernel/entry/common.c:98 __exit_to_user_mode_prepare include/linux/irq-entry-common.h:226 [inline] syscall_exit_to_user_mode_prepare include/linux/irq-entry-common.h:256 [inline] syscall_exit_to_user_mode include/linux/entry-common.h:325 [inline] do_syscall_64+0x32d/0xf80 arch/x86/entry/syscall_64.c:100 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f1f91b9c799 Code: Unable to access opcode bytes at 0x7f1f91b9c76f. RSP: 002b:00007f1f92a9a0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca RAX: 0000000000000001 RBX: 00007f1f91e15fa8 RCX: 00007f1f91b9c799 RDX: 00000000000f4240 RSI: 0000000000000081 RDI: 00007f1f91e15fac RBP: 00007f1f91e15fa0 R08: 3fffffffffffffff R09: 0000000000000000 R10: ffffffffffffffff R11: 0000000000000246 R12: 0000000000000000 R13: 00007f1f91e16038 R14: 00007ffdf0858f90 R15: 00007ffdf0859078 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:__list_del_entry_valid_or_report+0xdf/0x190 lib/list_debug.c:52 Code: 49 39 1f 0f 85 9e 00 00 00 b0 01 5b 41 5c 41 5d 41 5e 41 5f e9 52 5c f8 06 cc 48 c7 c7 a0 e8 27 8c 48 89 de e8 12 51 6e fc 90 <0f> 0b 48 c7 c7 00 e9 27 8c 48 89 de e8 00 51 6e fc 90 0f 0b 4c 89 RSP: 0018:ffffc90000007d58 EFLAGS: 00010046 RAX: 0000000000000033 RBX: ffff888050dfa090 RCX: 8dc35dc03e074800 RDX: 0000000000000100 RSI: 0000000080000102 RDI: 0000000000000000 RBP: 0000000000000203 R08: ffffc90000007ae7 R09: 1ffff92000000f5c R10: dffffc0000000000 R11: fffff52000000f5d R12: 1ffff1100a1bf412 R13: dffffc0000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff888125457000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 000055e5656e7000 CR3: 0000000077ef2000 CR4: 00000000003526f0 ---------------- Code disassembly (best guess): 0: e9 30 ff ff ff jmp 0xffffff35 5: e8 85 50 0d 0a call 0xa0d508f a: f7 c3 00 02 00 00 test $0x200,%ebx 10: 0f 84 38 ff ff ff je 0xffffff4e 16: 65 48 8b 05 01 fe 7a mov %gs:0x117afe01(%rip),%rax # 0x117afe1f 1d: 11 1e: 48 3b 44 24 30 cmp 0x30(%rsp),%rax 23: 75 33 jne 0x58 25: fb sti 26: 48 83 c4 38 add $0x38,%rsp * 2a: 5b pop %rbx <-- trapping instruction 2b: 41 5c pop %r12 2d: 41 5d pop %r13 2f: 41 5e pop %r14 31: 41 5f pop %r15 33: 5d pop %rbp 34: c3 ret 35: cc int3 36: cc int3 37: cc int3 38: cc int3 39: cc int3 3a: 48 rex.W 3b: 8d .byte 0x8d 3c: 3d .byte 0x3d 3d: 8e .byte 0x8e 3e: aa stos %al,%es:(%rdi) 3f: 73 .byte 0x73